@attalabs/vinaya 0.21.0 → 0.23.0

package/dist/checks/bin/check-doctrine-portability.js

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/checks/bin/check-doctrine-portability.ts
-import { execFileSync as execFileSync3 } from "node:child_process";
-import { readdirSync, readFileSync as readFileSync2, statSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { readdirSync, readFileSync as readFileSync3, statSync } from "node:fs";
+import { join as join3 } from "node:path";
 // ../../packages/aeg-core/src/gate-audience.ts
 var GATE_AUDIENCE = {
   "check-branch-topology": { shippedAs: "branch-topology", ring: 0 },
@@ -212,17 +214,18 @@ function splitIds(raw) {
     return [];
   return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0 && !isEmptyMarker(s) && ID_TOKEN.test(s));
 }
-function resolveIds(raw, lastSlug) {
+function resolveIds(raw) {
   const ids = splitIds(raw);
   const resolved = [];
+  let lastSlug = null;
   for (const id of ids) {
     const qualified = id.match(SLUG_QUALIFIED_ID);
     if (qualified) {
-      lastSlug.current = qualified[1] ?? null;
+      lastSlug = qualified[1] ?? null;
       resolved.push(id);
-    } else if (lastSlug.current) {
-      resolved.push(`${lastSlug.current} ${id}`);
-      lastSlug.current = null;
+    } else if (lastSlug) {
+      resolved.push(`${lastSlug} ${id}`);
+      lastSlug = null;
     } else {
       resolved.push(id);
     }
@@ -242,12 +245,7 @@ function parseRationaleDeps(body) {
   const section = extractSection(body);
   const dependsOn = [];
   const conflictsWith = [];
-  let current = null;
   const assignedFields = new Set;
-  const lastSlugByField = {
-    dependsOn: { current: null },
-    conflictsWith: { current: null }
-  };
   const spanPattern = /`([^`]*)`/g;
   let match = spanPattern.exec(section);
   while (match !== null) {
@@ -257,13 +255,9 @@ function parseRationaleDeps(body) {
       const field = labelMatch[1]?.toLowerCase() === "conflicts-with" ? "conflictsWith" : "dependsOn";
       if (!assignedFields.has(field)) {
         assignedFields.add(field);
-        current = field;
-        const ids = resolveIds(labelMatch[2] ?? "", lastSlugByField[field]);
+        const ids = resolveIds(labelMatch[2] ?? "");
         pushUnique(field === "dependsOn" ? dependsOn : conflictsWith, ids);
       }
-    } else if (current) {
-      const ids = resolveIds(content, lastSlugByField[current]);
-      pushUnique(current === "dependsOn" ? dependsOn : conflictsWith, ids);
     }
     match = spanPattern.exec(section);
   }
@@ -1728,6 +1722,48 @@ function splitTableRow(row) {
     parts.pop();
   return parts.map((p) => p.split(PLACEHOLDER).join("|"));
 }
+// ../../packages/aeg-core/src/blast-radius-domains.ts
+function resolveWorkspaceEntry(entry2, listDirs) {
+  if (entry2.endsWith("/*")) {
+    const baseDir = entry2.slice(0, -2);
+    return listDirs(baseDir).map((name) => `${baseDir}/${name}`);
+  }
+  if (entry2.includes("*"))
+    return [];
+  return [entry2];
+}
+// ../../packages/aeg-core/src/consumer-enumeration.ts
+function deriveWorkspaceMemberDirs(workspaces, listDirs) {
+  const positive = workspaces.filter((entry2) => !entry2.startsWith("!"));
+  const negative = workspaces.filter((entry2) => entry2.startsWith("!")).map((entry2) => entry2.slice(1));
+  const excluded = new Set;
+  for (const entry2 of negative) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs))
+      excluded.add(member);
+  }
+  const members = new Set;
+  for (const entry2 of positive) {
+    for (const member of resolveWorkspaceEntry(entry2, listDirs)) {
+      if (!excluded.has(member))
+        members.add(member);
+    }
+  }
+  return [...members].sort();
+}
+function buildConsumersOf(workspaces, listDirs, readManifest) {
+  const members = deriveWorkspaceMemberDirs(workspaces, listDirs);
+  return (pkg) => {
+    const target = `@attalabs/${pkg}`;
+    return members.filter((dir) => {
+      if (dir === `packages/${pkg}`)
+        return false;
+      const manifest = readManifest(dir);
+      if (!manifest)
+        return false;
+      return target in (manifest.dependencies ?? {}) || target in (manifest.devDependencies ?? {});
+    });
+  };
+}
 // ../../packages/aeg-core/src/state-machine-model.ts
 var FORGE_FACT_INPUTS = [
   {
@@ -1793,6 +1829,156 @@ var DERIVED_STATUSES = [
   "incoherent"
 ];
 var DERIVABLE_STATUSES = DERIVED_STATUSES.filter((s) => s !== "backlog");
+// ../../packages/aeg-core/src/parse-ledger.ts
+function rowFromCells(cells) {
+  if (cells.length < 7)
+    return null;
+  const phase = (cells[0] ?? "").trim();
+  if (!phase)
+    return null;
+  return {
+    phase,
+    role: (cells[1] ?? "").trim(),
+    agentModel: (cells[2] ?? "").trim(),
+    tokensIn: parseIntCell(cells[3] ?? ""),
+    tokensOut: parseIntCell(cells[4] ?? ""),
+    cost: parseCostCell(cells[5] ?? ""),
+    date: (cells[6] ?? "").trim()
+  };
+}
+function parseIntCell(cell) {
+  const trimmed = cell.replace(/`/g, "").trim();
+  if (!trimmed || isEmDashOrDash(trimmed))
+    return null;
+  const normalized = trimmed.replace(/[,_\s]/g, "");
+  if (!/^-?\d+$/.test(normalized))
+    return null;
+  return Number(normalized);
+}
+function parseCostCell(cell) {
+  const trimmed = cell.replace(/`/g, "").trim();
+  if (!trimmed || isEmDashOrDash(trimmed))
+    return null;
+  const normalized = trimmed.replace(/^\$/, "").replace(/[,_\s]/g, "");
+  if (!/^-?\d+(\.\d+)?$/.test(normalized))
+    return null;
+  return Number(normalized);
+}
+function isEmDashOrDash(s) {
+  const t = s.trim();
+  return t === "—" || t === "-" || t === "–";
+}
+// ../../packages/aeg-core/src/waiver-label.ts
+var WAIVER_LABEL = label("waiver-docs");
+var WAIVER_LABEL_REVIEW = label("waiver-review");
+var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
+function isPrincipal(login, principalAllowlist) {
+  if (login === null)
+    return false;
+  const normalized = login.toLowerCase();
+  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
+}
+function isWaiverLabelActorVerified(opts) {
+  if (!opts.labels.includes(opts.label))
+    return false;
+  return isPrincipal(opts.labelActor, opts.principalAllowlist);
+}
+
+// ../../packages/aeg-core/src/parse-token-report.ts
+var TOKEN_REPORT_HEADING = /^\s*(?:#{1,6}\s*Token report\s*|\*\*Token report\*\*)\s*$/i;
+var INLINE_FIELD_LIST = /Phase:\s*([^|]+?)\s*\|\s*Role:\s*([^|]+?)\s*\|\s*Agent\/Model:\s*([^|]+?)\s*\|\s*Tokens in:\s*([^|]+?)\s*\|\s*Tokens out:\s*([^|]+?)\s*\|\s*Cost:\s*([^|]+?)\s*\|\s*Date:\s*(.+?)\s*$/im;
+function parseTokenReportEntries(body) {
+  const lines = body.split(/\r?\n/);
+  const headingIdxs = [];
+  lines.forEach((line, i) => {
+    if (TOKEN_REPORT_HEADING.test(line))
+      headingIdxs.push(i);
+  });
+  const out = [];
+  for (let h = 0;h < headingIdxs.length; h++) {
+    const start = headingIdxs[h] + 1;
+    const end = h + 1 < headingIdxs.length ? headingIdxs[h + 1] : lines.length;
+    const section = lines.slice(start, end).join(`
+`);
+    const tableRows = parseTableSection(section);
+    if (tableRows.length > 0) {
+      out.push(...tableRows);
+      continue;
+    }
+    const inlineRow = parseInlineFieldList(section);
+    if (inlineRow)
+      out.push(inlineRow);
+  }
+  return out;
+}
+function parseTableSection(section) {
+  const lines = section.split(/\r?\n/);
+  let i = 0;
+  for (;i < lines.length; i++) {
+    if ((lines[i] ?? "").trim().startsWith("|"))
+      break;
+  }
+  if (i + 1 >= lines.length)
+    return [];
+  i += 2;
+  const out = [];
+  for (;i < lines.length; i++) {
+    const trimmed = (lines[i] ?? "").trim();
+    if (!trimmed.startsWith("|"))
+      break;
+    const row = rowFromCells(splitTableRow(trimmed));
+    if (row)
+      out.push(row);
+  }
+  return out;
+}
+function parseInlineFieldList(section) {
+  const m = section.match(INLINE_FIELD_LIST);
+  if (!m)
+    return null;
+  return rowFromCells([m[1], m[2], m[3], m[4], m[5], m[6], m[7]]);
+}
+// ../../packages/aeg-core/src/verdict-extraction.ts
+var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
+function firstThreeLines(comment) {
+  return comment.split(`
+`).slice(0, 3).join(`
+`);
+}
+function extractHeadSha(comment) {
+  const m = firstThreeLines(comment).match(HEAD_SHA_PATTERN);
+  return m ? m[1].toLowerCase() : null;
+}
+function extractVerdict(comments, valuePattern, missingLabel) {
+  const candidates = comments.filter((c) => valuePattern.test(c));
+  if (candidates.length === 0) {
+    return {
+      value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
+      headSha: null,
+      danglingNote: `no ${missingLabel} verdict comment found on this PR`
+    };
+  }
+  const latest = candidates[candidates.length - 1];
+  const m = firstThreeLines(latest).match(valuePattern);
+  if (!m) {
+    return {
+      value: `the most recent ${missingLabel} comment's VERDICT line is not within its first three lines — DANGLING, see below`,
+      headSha: null,
+      danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-three-line read window`
+    };
+  }
+  return {
+    value: m[1].toUpperCase().replace(/[_-]/g, " "),
+    headSha: extractHeadSha(latest),
+    danglingNote: null
+  };
+}
+function extractCodeReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(APPROVE|REQUEST[ _-]?CHANGES|LGTM)(?![A-Za-z0-9])/im, "code-reviewer");
+}
+function extractSecurityReviewVerdict(comments) {
+  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
+}
 // ../../packages/aeg-core/src/report-tokens.ts
 var DASH_LOOKALIKES = {
   "-": "‑",
@@ -1801,6 +1987,7 @@ var DASH_LOOKALIKES = {
 };
 var DASH_CHARS = new Set(Object.keys(DASH_LOOKALIKES));
 // ../../packages/aeg-core/src/claude-code-transcript.ts
+import { createHash } from "node:crypto";
 function summarizeTranscript(jsonl) {
   const seen = new Set;
   const components = {
@@ -1849,7 +2036,14 @@ function numberOr(value, fallback) {
 function sanitizeKey(value) {
   return value.replace(/[^A-Za-z0-9]+/g, "-");
 }
+function collisionResistantKey(value) {
+  const digest = createHash("sha256").update(value).digest("hex");
+  return `${sanitizeKey(value)}-${digest}`;
+}
 function transcriptPointerPath(projectDir, tmpDir) {
+  return `${tmpDir}/claude-transcript-${collisionResistantKey(projectDir)}.txt`;
+}
+function legacyTranscriptPointerPath(projectDir, tmpDir) {
   return `${tmpDir}/claude-transcript-${sanitizeKey(projectDir)}.txt`;
 }
 function resolvePointer(explicitTranscriptPath, deps) {
@@ -1857,13 +2051,15 @@ function resolvePointer(explicitTranscriptPath, deps) {
     return { path: explicitTranscriptPath, corroborated: true };
   const projectDir = deps.env.CLAUDE_PROJECT_DIR ?? deps.cwd;
   const tmpDir = deps.env.TMPDIR ?? "/tmp";
-  const pointerPath = transcriptPointerPath(projectDir, tmpDir);
+  const primaryPointerPath = transcriptPointerPath(projectDir, tmpDir);
+  const legacyPointerPath = legacyTranscriptPointerPath(projectDir, tmpDir);
   const currentSessionId = deps.env.CLAUDE_CODE_SESSION_ID;
-  if (!deps.exists(pointerPath)) {
+  const pointerPath = deps.exists(primaryPointerPath) ? primaryPointerPath : deps.exists(legacyPointerPath) ? legacyPointerPath : undefined;
+  if (!pointerPath) {
     return {
       pointerExisted: false,
       corroborated: false,
-      error: `No transcript pointer at ${pointerPath} and no --transcript given. ` + "Either this repo installs no track-transcript.sh Stop hook (lacking one is not a defect — " + "name the transcript directly instead), or no session has completed a turn yet."
+      error: `No transcript pointer at ${primaryPointerPath} (nor its pre-migration name ${legacyPointerPath}) ` + "and no --transcript given. Either this repo installs no track-transcript.sh Stop hook (lacking one " + "is not a defect — name the transcript directly instead), or no session has completed a turn yet."
     };
   }
   let contents;
@@ -1938,28 +2134,15 @@ function isTokenCollectionWiringBroken(capability) {
     return false;
   return capability.reason !== "no-transcript-resolved";
 }
+// ../../packages/aeg-core/src/metering-io-guard.ts
+import { closeSync, constants as fsConstants, fstatSync, openSync, readFileSync } from "node:fs";
+var GUARD_OPEN_FLAGS = fsConstants.O_RDONLY | fsConstants.O_NONBLOCK | fsConstants.O_NOFOLLOW;
 // ../../packages/aeg-core/src/file-classify.ts
 function isCodeFile(p) {
   if (p.endsWith(".md"))
     return false;
   return /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|sql|css)$/.test(p);
 }
-// ../../packages/aeg-core/src/waiver-label.ts
-var WAIVER_LABEL = label("waiver-docs");
-var WAIVER_LABEL_REVIEW = label("waiver-review");
-var PRINCIPAL_ALLOWLIST = ["daniboomerang"];
-function isPrincipal(login, principalAllowlist) {
-  if (login === null)
-    return false;
-  const normalized = login.toLowerCase();
-  return principalAllowlist.some((p) => p.toLowerCase() === normalized);
-}
-function isWaiverLabelActorVerified(opts) {
-  if (!opts.labels.includes(opts.label))
-    return false;
-  return isPrincipal(opts.labelActor, opts.principalAllowlist);
-}
-
 // ../../packages/aeg-core/src/doc-owners.ts
 var DOC_OWNERS_PATH = ".vinaya/doc-owners";
 function parseDocOwners(content) {
@@ -2144,7 +2327,7 @@ function overrideActive(opts) {
   return false;
 }
 // ../../packages/aeg-core/src/premise-check.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
 function isPremiseHeader(line) {
   const stripped = line.replace(/[*#]/g, "").trim();
@@ -2176,6 +2359,32 @@ function parsePremiseBlock(prBody) {
   }
   return assertions;
 }
+function premiseBlockText(prBody) {
+  const searchIn = anchoredRegion(prBody, "PREMISE") ?? prBody;
+  const lines = searchIn.split(/\r?\n/);
+  let startIdx = -1;
+  let endIdxExclusive = lines.length;
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i].trim();
+    if (startIdx === -1) {
+      if (isPremiseHeader(line))
+        startIdx = i;
+      continue;
+    }
+    if (line === "") {
+      endIdxExclusive = i;
+      break;
+    }
+    if (!PREMISE_LINE.test(line)) {
+      endIdxExclusive = i;
+      break;
+    }
+  }
+  if (startIdx === -1)
+    return null;
+  return lines.slice(startIdx, endIdxExclusive).join(`
+`);
+}
 function checkPremises(assertions, fileReader) {
   const failures = [];
   for (const a of assertions) {
@@ -2189,7 +2398,7 @@ function checkPremises(assertions, fileReader) {
     } else if (a.kind === "absent" && content.includes(a.value)) {
       failures.push(`premise-check: ${a.path} now contains "${a.value}", but the brief pinned it absent — the premise has moved; re-dig before proceeding.`);
     } else if (a.kind === "sha256") {
-      const actual = createHash("sha256").update(content).digest("hex");
+      const actual = createHash2("sha256").update(content).digest("hex");
       if (actual !== a.value.toLowerCase()) {
         failures.push(`premise-check: ${a.path} sha256 mismatch (brief pinned ${a.value}, file is now ${actual}) — the file changed since this brief was authored; re-dig before proceeding.`);
       }
@@ -2262,15 +2471,18 @@ function testPlanRegion(prBody) {
   return located.found ? located.section : prBody;
 }
 function checkTestPlan(prBody) {
-  const region = testPlanRegion(prBody);
+  const located = locateTestPlanSection(prBody);
+  const region = located.found ? located.section : prBody;
   if (TEST_PLAN_UNIT_TESTS_ONLY_RE.test(region))
     return { status: "pass", errors: [] };
   if (/\*\*\[(?:agent|principal)\]\*\*/.test(region))
     return { status: "pass", errors: [] };
+  if (located.found && extractFencedBlocks(region).length > 0)
+    return { status: "pass", errors: [] };
   return {
     status: "fail",
     errors: [
-      "brief-validation Test Plan: no Test Plan section found — expected `Test Plan: unit-tests-only`, or at least one `**[agent]**`/`**[principal]**`-tagged checklist item."
+      "brief-validation Test Plan: no Test Plan section found — expected `Test Plan: unit-tests-only`, a fenced `[agent]` command list, or at least one `**[agent]**`/`**[principal]**`-tagged checklist item."
     ]
   };
 }
@@ -2393,8 +2605,162 @@ function isBriefShaped(prBody) {
   const stripped = stripCode(prBody);
   return BRIEF_SHAPE_MARKERS.filter((check) => check(stripped).status === "pass").length >= 2;
 }
+var COMMAND_WORDS = ["export", "bun", "gh", "git", "grep", "sed", "cat", "diff", "vinaya"];
+var BRIEF_RULES_SINCE_PR = 394;
+var AGENT_BOXES_REFUSED_SINCE_PR = 396;
+var AGENT_BOX_LINE_RE = /^-\s*\[[ xX]\]\s*\*{2}\[agent\]\*{2}/im;
+function checkNoAgentBoxes(prBody) {
+  const region = testPlanRegion(prBody);
+  if (!AGENT_BOX_LINE_RE.test(region))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation no agent boxes: the Test Plan carries a checkbox `[agent]` item — an agent never ticks a box or edits a PR body (Principal ruling, 2026-09-03, after PR #395). Render the `[agent]` half as a fenced command list instead; `vinaya pr report` runs each command from the PR head and writes its actual output into the AEG:EVIDENCE block. `[principal]` checkboxes are unaffected."
+    ]
+  };
+}
+function rolloutThresholdFor(message) {
+  if (message.startsWith("brief-validation unpinned code claim:") || message.startsWith("brief-validation commands carry output:") || message.startsWith("brief-validation consumer tests:") || message.startsWith("brief-validation defeat cases:")) {
+    return BRIEF_RULES_SINCE_PR;
+  }
+  if (message.startsWith("brief-validation no agent boxes:"))
+    return AGENT_BOXES_REFUSED_SINCE_PR;
+  return null;
+}
+function partitionBriefErrorsByRollout(errors, prNumber) {
+  const blocking = [];
+  const info = [];
+  for (const e of errors) {
+    const threshold = rolloutThresholdFor(e);
+    const grandfathered = threshold !== null && prNumber !== null && prNumber < threshold;
+    (grandfathered ? info : blocking).push(e);
+  }
+  return { blocking, info };
+}
+function extractFencedBlocks(text) {
+  const re = /^[ \t]*(`{3,}|~{3,})([^\n]*)\n([\s\S]*?)^[ \t]*\1[ \t]*$/gm;
+  const blocks = [];
+  let m = re.exec(text);
+  while (m !== null) {
+    const lang = m[2].trim().toLowerCase().split(/\s+/)[0] ?? "";
+    blocks.push({ start: m.index, end: m.index + m[0].length, lang, content: m[3] });
+    m = re.exec(text);
+  }
+  return blocks;
+}
+function firstNonBlankLine(text) {
+  const line = text.split(`
+`).find((l) => l.trim().length > 0);
+  return line?.trim() ?? "";
+}
+var FILE_LINE_RE = /\b[\w./-]+\.(?:tsx?|jsx?|mjs|cjs|md|mdx|json|ya?ml|sh|py|toml):\d+\b/g;
+function checkNoUnpinnedCodeClaims(prBody) {
+  const premiseText = premiseBlockText(prBody);
+  const withoutPremise = premiseText ? prBody.replace(premiseText, "") : prBody;
+  const scanned = stripCode(withoutPremise, { inlineSpans: "keep" });
+  const matches = scanned.match(FILE_LINE_RE) ?? [];
+  if (matches.length === 0)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: matches.map((m) => `brief-validation unpinned code claim: "${m}" states a code fact by file-and-line reference outside a \`Premise:\` pin and outside a fenced code block — pin it in \`Premise:\`, or show the executed command and its output instead.`)
+  };
+}
+function extractNumberedSection(prBody, num) {
+  const startRe = new RegExp(`^#{1,4}\\s*(?:\\*\\*)?${num}[a-z]?\\.\\s`, "im");
+  const start = startRe.exec(prBody);
+  if (!start)
+    return null;
+  const afterStart = start.index + start[0].length;
+  const rest = prBody.slice(afterStart);
+  const next = /^#{1,4}\s/m.exec(rest);
+  return next ? rest.slice(0, next.index) : rest;
+}
+function commandWordOf(line) {
+  return line.trim().split(/\s+/)[0] ?? "";
+}
+function isCommandBlock(content) {
+  return COMMAND_WORDS.includes(commandWordOf(firstNonBlankLine(content)));
+}
+function isStep0Block(content) {
+  return firstNonBlankLine(content).startsWith("git worktree add");
+}
+function checkCommandsCarryOutput(prBody) {
+  const errors = [];
+  for (const [label2, num] of [
+    ["5", 5],
+    ["6", 6]
+  ]) {
+    const section = extractNumberedSection(prBody, num);
+    if (!section)
+      continue;
+    const blocks = extractFencedBlocks(section);
+    for (let i = 0;i < blocks.length; i++) {
+      const block = blocks[i];
+      if (isStep0Block(block.content) || !isCommandBlock(block.content))
+        continue;
+      const next = blocks[i + 1];
+      if (!next || isCommandBlock(next.content)) {
+        errors.push(`brief-validation commands carry output: §${label2} has a command block ("${firstNonBlankLine(block.content)}") not immediately followed by a non-command output block — the very next fenced block must hold that command's actual output, not another command.`);
+      }
+    }
+  }
+  return errors.length === 0 ? { status: "pass", errors: [] } : { status: "fail", errors };
+}
+var CONSUMER_TESTS_SENTINEL_RE = /consumer-tests\s*:\s*none\s*[-—–]\s*\S/i;
+function packagesNamedIn(text) {
+  const re = /\bpackages\/([A-Za-z0-9_-]+)\//g;
+  const pkgs = new Set;
+  let m = re.exec(text);
+  while (m !== null) {
+    pkgs.add(m[1]);
+    m = re.exec(text);
+  }
+  return [...pkgs];
+}
+function hasTestPathForConsumer(text, consumerDir) {
+  const escaped = consumerDir.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const re = new RegExp(`${escaped}\\/[\\w./-]*\\.test\\.[A-Za-z0-9]+`);
+  return re.test(text);
+}
+function checkConsumerTests(prBody, consumersOf) {
+  const section4 = extractNumberedSection(prBody, 4);
+  if (!section4)
+    return { status: "pass", errors: [] };
+  if (CONSUMER_TESTS_SENTINEL_RE.test(section4))
+    return { status: "pass", errors: [] };
+  const errors = [];
+  for (const pkg of packagesNamedIn(section4)) {
+    for (const consumerDir of consumersOf(pkg)) {
+      if (hasTestPathForConsumer(section4, consumerDir))
+        continue;
+      errors.push(`brief-validation consumer tests: §4 names a path under packages/${pkg}/, and ${consumerDir} depends on @attalabs/${pkg}, but no test path under ${consumerDir} is named in §4 — name one, or add \`consumer-tests: none — <reason>\`.`);
+    }
+  }
+  return errors.length === 0 ? { status: "pass", errors: [] } : { status: "fail", errors };
+}
+var CHECK_NAME_RE = /\bcheck-[a-z0-9-]+(?:\.ts)?\b/;
+var FORGE_WRITE_COMMAND_RE = /\bgh\s+(?:pr|issue)\s+(?:create|merge|close|comment|edit|review)\b|\bgit\s+push\b|\bvinaya\s+pr\s+(?:create|report\s+--write)\b/i;
+var DEFEAT_CASES_RE = /defeat cases\s*:/i;
+function checkDefeatCases(prBody) {
+  const section4 = extractNumberedSection(prBody, 4);
+  if (!section4)
+    return { status: "pass", errors: [] };
+  if (!CHECK_NAME_RE.test(section4) && !FORGE_WRITE_COMMAND_RE.test(section4))
+    return { status: "pass", errors: [] };
+  const section6 = extractNumberedSection(prBody, 6) ?? "";
+  if (DEFEAT_CASES_RE.test(section6))
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      "brief-validation defeat cases: §4 names a check or a forge-writing command, but §6 carries no `Defeat cases:` line — name the inputs that would defeat this check, or that this command must not accidentally trigger on."
+    ]
+  };
+}
 function checkBriefSections(prBody, readTier, options = {}) {
-  const { requireClosesN = true } = options;
+  const { requireClosesN = true, consumersOf = () => [] } = options;
   const results = [
     checkTierField(prBody, readTier),
     checkTestPlan(prBody),
@@ -2407,10 +2773,219 @@ function checkBriefSections(prBody, readTier, options = {}) {
     checkAutonomyClause(prBody),
     checkProjectField(prBody),
     checkForField(prBody),
+    checkNoUnpinnedCodeClaims(prBody),
+    checkNoAgentBoxes(prBody),
+    checkCommandsCarryOutput(prBody),
+    checkConsumerTests(prBody, consumersOf),
+    checkDefeatCases(prBody),
     ...requireClosesN ? [checkClosesN(prBody)] : []
   ];
   return { errors: results.flatMap((r) => r.errors) };
 }
+// ../../packages/aeg-core/src/doctrine-portability.ts
+var DEFAULT_SHIPS_PREFIX = "aeg-root/";
+var STATIC_PORTABLE_PREFIXES = [
+  "roles/",
+  "contracts/",
+  "skills/",
+  ".github/",
+  ".vinaya/",
+  ".claude/",
+  ".git/",
+  ".husky/"
+];
+var EXEMPT_LITERALS = new Set([
+  "path/inside/the/shipped/diff.ts",
+  "path/inside/the/surface.ts",
+  "apps/x/specs/..."
+]);
+var CITED_PATH_PATTERN = /^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]*)+$/;
+var NON_PATH_TOP_SEGMENTS = new Set(["origin", "refs", "HEAD", "vinaya", "fix"]);
+var VENDOR_NAME_SOURCE = "\\bclaude code\\b|\\bclaude\\b|\\banthropic\\b|\\bchatgpt\\b|\\bopenai\\b|\\bgpt\\b|\\bgemini\\b|\\bcodex\\b|\\bgrok\\b|\\bdeepseek\\b|\\bopus\\b|\\bsonnet\\b|\\bhaiku\\b";
+var VENDOR_EXAMPLE_START = /<!--\s*AEG:VENDOR-EXAMPLE:START\s*-->/;
+var VENDOR_EXAMPLE_END = /<!--\s*AEG:VENDOR-EXAMPLE:END\s*-->/;
+function maskVendorExampleRegion(masked) {
+  const start = VENDOR_EXAMPLE_START.exec(masked);
+  if (!start)
+    return masked;
+  const afterStart = start.index + start[0].length;
+  const end = VENDOR_EXAMPLE_END.exec(masked.slice(afterStart));
+  if (!end)
+    return masked;
+  const regionEnd = afterStart + end.index + end[0].length;
+  const region = masked.slice(start.index, regionEnd);
+  const blanked = region.replace(/[^\n]/g, " ");
+  return masked.slice(0, start.index) + blanked + masked.slice(regionEnd);
+}
+function extractVendorMentions(content) {
+  const scoped = maskVendorExampleRegion(maskCode(content));
+  const found = [];
+  const pattern = new RegExp(VENDOR_NAME_SOURCE, "gi");
+  let match = pattern.exec(scoped);
+  while (match !== null) {
+    found.push({ name: match[0], index: match.index });
+    match = pattern.exec(scoped);
+  }
+  return found;
+}
+function extractCitedPaths(content) {
+  const found = [];
+  const spanPattern = /`([^`\n]+)`/g;
+  let match = spanPattern.exec(content);
+  while (match !== null) {
+    const cited = match[1] ?? "";
+    const topSegment = cited.slice(0, cited.indexOf("/"));
+    if (CITED_PATH_PATTERN.test(cited) && !NON_PATH_TOP_SEGMENTS.has(topSegment)) {
+      found.push({ cited, index: match.index });
+    }
+    match = spanPattern.exec(content);
+  }
+  return found;
+}
+function lineAtIndex(content, index) {
+  let line = 1;
+  for (let i = 0;i < index; i++) {
+    if (content.charCodeAt(i) === 10)
+      line++;
+  }
+  return line;
+}
+function isPortable(cited, shipsPrefix) {
+  if (cited.startsWith(shipsPrefix))
+    return true;
+  return STATIC_PORTABLE_PREFIXES.some((prefix) => cited.startsWith(prefix));
+}
+function checkDoctrinePortability(files, shipsPrefix = DEFAULT_SHIPS_PREFIX) {
+  const findings = [];
+  for (const file of files) {
+    if (!file.path.startsWith(shipsPrefix))
+      continue;
+    for (const { cited, index } of extractCitedPaths(file.content)) {
+      if (EXEMPT_LITERALS.has(cited))
+        continue;
+      if (isPortable(cited, shipsPrefix))
+        continue;
+      findings.push({
+        file: file.path,
+        line: lineAtIndex(file.content, index),
+        cited,
+        message: `cites "${cited}", a path that only exists in the authoring repository — not portable doctrine`,
+        kind: "path"
+      });
+    }
+    for (const { name, index } of extractVendorMentions(file.content)) {
+      findings.push({
+        file: file.path,
+        line: lineAtIndex(file.content, index),
+        cited: name,
+        message: `names "${name}" outside the one fenced vendor-example home (an <!-- AEG:VENDOR-EXAMPLE:START --> … <!-- AEG:VENDOR-EXAMPLE:END --> pair) — portable doctrine refers to a host generically everywhere else`,
+        kind: "vendor-name"
+      });
+    }
+  }
+  return findings;
+}
+
+// ../../packages/aeg-core/src/doctrine-no-procedures.ts
+function vendorExampleSpan(content) {
+  const start = VENDOR_EXAMPLE_START.exec(content);
+  if (!start)
+    return null;
+  const afterStart = start.index + start[0].length;
+  const end = VENDOR_EXAMPLE_END.exec(content.slice(afterStart));
+  if (!end)
+    return null;
+  return { start: start.index, end: afterStart + end.index + end[0].length };
+}
+function isCommandLine(line) {
+  const word = line.trim().split(/\s+/)[0] ?? "";
+  return COMMAND_WORDS.includes(word);
+}
+var SHELL_LANGS = new Set(["", "sh", "bash", "shell", "console"]);
+function procedureLineNumberAt(content, index) {
+  return content.slice(0, index).split(`
+`).length;
+}
+function isTemplatePath(path) {
+  return /(^|\/)templates\//.test(path);
+}
+function checkDoctrineNoProcedures(files) {
+  const findings = [];
+  for (const file of files) {
+    if (isTemplatePath(file.path))
+      continue;
+    const span = vendorExampleSpan(file.content);
+    for (const block of extractFencedBlocks(file.content)) {
+      if (span && block.start >= span.start && block.end <= span.end)
+        continue;
+      if (!SHELL_LANGS.has(block.lang))
+        continue;
+      const commandLineCount = block.content.split(`
+`).filter(isCommandLine).length;
+      if (commandLineCount >= 2) {
+        findings.push({
+          file: file.path,
+          line: procedureLineNumberAt(file.content, block.start),
+          message: `this fenced block has ${commandLineCount} shell-command lines — this sequence is a \`vinaya\` command, name it (or move it inside the \`AEG:VENDOR-EXAMPLE\` anchor / a \`templates/\` file).`
+        });
+      }
+    }
+  }
+  return findings;
+}
+// ../../packages/aeg-core/src/pr-report-density.ts
+function headingSectionBody(prBody, heading) {
+  const headingRe = new RegExp(`^##\\s+${heading}\\s*$`, "im");
+  const m = headingRe.exec(prBody);
+  if (!m)
+    return null;
+  const start = m.index + m[0].length;
+  const rest = prBody.slice(start);
+  const nextHeading = /^#{1,2}\s/m.exec(rest);
+  return nextHeading ? rest.slice(0, nextHeading.index) : rest;
+}
+function stripAnchorBlocks(sectionText) {
+  let result = sectionText;
+  for (const field of ["CLOSES", "PROJECT", "TIER", "PREMISE", "TEST-PLAN", "EVIDENCE"]) {
+    for (;; ) {
+      const bounds = anchoredRegionBounds(result, field);
+      if (!bounds)
+        break;
+      result = result.slice(0, bounds.outerStart) + result.slice(bounds.outerEnd);
+    }
+  }
+  return result;
+}
+function paragraphCount(sectionText) {
+  const stripped = stripCode(stripAnchorBlocks(sectionText)).trim();
+  if (stripped.length === 0)
+    return 0;
+  return stripped.split(/\n[ \t]*\n/).map((block) => block.trim()).filter((block) => block.length > 0).length;
+}
+function checkSectionDensity(prBody, heading) {
+  const body = headingSectionBody(prBody, heading);
+  if (body === null)
+    return { status: "pass", errors: [] };
+  const count = paragraphCount(body);
+  if (count <= 1)
+    return { status: "pass", errors: [] };
+  return {
+    status: "fail",
+    errors: [
+      `pr-report-density ${heading}: "## ${heading}" holds ${count} paragraphs — the canonical PR-report form (aeg-root/roles/developer.md § PR body) requires exactly one. Collapse it to one paragraph; move the rest into a section of your own below the canonical four ("Add anything you want beneath the four sections", developer.md), a commit message, or the changeset — never into the AEG:EVIDENCE block, which is emitted only, never hand-typed.`
+    ]
+  };
+}
+function checkSummaryDensity(prBody) {
+  return checkSectionDensity(prBody, "Summary");
+}
+function checkScopeDensity(prBody) {
+  return checkSectionDensity(prBody, "Scope");
+}
+function checkPrReportDensity(prBody) {
+  const results = [checkSummaryDensity(prBody), checkScopeDensity(prBody)];
+  return { errors: results.flatMap((r) => r.errors) };
+}
 // ../../packages/aeg-core/src/issue-validation.ts
 function hasRationaleField(body, labelPattern) {
   const re = new RegExp(`(?:\\*\\*|^#{1,4}\\s+)\\s*(?:${labelPattern})`, "im");
@@ -2662,6 +3237,17 @@ function checkD1(entries, issueToEntry, taskToEntry) {
       const depEntry = resolveDepEntry(dep, e.trancheSlug, issueToEntry, taskToEntry);
       if (!depEntry)
         continue;
+      const sameTask = depEntry.trancheSlug === e.trancheSlug && depEntry.task.id === e.task.id;
+      const sameIssue = depEntry.task.issue !== null && e.task.issue !== null && depEntry.task.issue === e.task.issue;
+      if (sameTask || sameIssue) {
+        failures.push({
+          issue: e.task.issue,
+          tranche: e.trancheSlug,
+          task: e.task.id,
+          reason: `INTERNAL: parsed a self-dependency (depends-on ${dep}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream.`
+        });
+        continue;
+      }
       const depFacts = depEntry.facts;
       const depClosed = depFacts?.issueState === "closed";
       if (!depClosed) {
@@ -2805,41 +3391,24 @@ function checkClosesN2(branch, prBody, trancheFiles, taskIssueRefs) {
   }
   return { ok: true, expectedIssue };
 }
-// ../../packages/aeg-core/src/verdict-extraction.ts
-var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
-function extractHeadSha(comment) {
-  const m = comment.match(HEAD_SHA_PATTERN);
-  return m ? m[1].toLowerCase() : null;
-}
-function extractVerdict(comments, valuePattern, missingLabel) {
-  const clearHits = comments.filter((c) => valuePattern.test(c));
-  if (clearHits.length > 0) {
-    const latest = clearHits[clearHits.length - 1];
-    const m = latest.match(valuePattern);
-    return {
-      value: m[1].toUpperCase().replace(/[_-]/g, " "),
-      headSha: extractHeadSha(latest),
-      danglingNote: null
-    };
-  }
-  return {
-    value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
-    headSha: null,
-    danglingNote: `no ${missingLabel} verdict comment found on this PR`
-  };
-}
-function extractCodeReviewVerdict(comments) {
-  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(APPROVE|REQUEST[ _-]?CHANGES|LGTM)(?![A-Za-z0-9])/im, "code-reviewer");
-}
-function extractSecurityReviewVerdict(comments) {
-  return extractVerdict(comments, /^[ \t]*(?:\*{1,3}|_{1,3})?VERDICT:\s*(PASS|FAIL)(?![A-Za-z0-9])/im, "security-review");
-}
 // ../../packages/aeg-core/src/review-gate.ts
 function isBoundToHead(extraction, headSha) {
   if (!extraction.headSha)
     return false;
   return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
 }
+function isBoundByPatchIdentity(extraction, headSha, patchIdOf) {
+  if (patchIdOf === undefined || !extraction.headSha)
+    return false;
+  const judged = patchIdOf(extraction.headSha);
+  const current = patchIdOf(headSha);
+  if (judged === null || current === null)
+    return false;
+  return judged === current;
+}
+function isBoundToPatch(extraction, headSha, patchIdOf) {
+  return isBoundToHead(extraction, headSha) || isBoundByPatchIdentity(extraction, headSha, patchIdOf);
+}
 function checkReviewGate(input) {
   const principalAllowlist = input.principalAllowlist ?? PRINCIPAL_ALLOWLIST;
   const waived = isWaiverLabelActorVerified({
@@ -2855,6 +3424,8 @@ function checkReviewGate(input) {
       waived: true
     };
   }
+  const reportedMechanicalChecks = input.mechanicalChecks.filter((c) => c.bucket !== "skipping" && c.bucket !== "neutral");
+  const mechanicalChecksClean = reportedMechanicalChecks.length > 0 && reportedMechanicalChecks.every((c) => c.bucket === "pass");
   const verified = input.comments.filter((c) => isPrincipal(c.author, principalAllowlist));
   const ignoredCount = input.comments.filter((c) => !isPrincipal(c.author, principalAllowlist) && c.body.includes("VERDICT")).length;
   const verifiedBodies = verified.map((c) => c.body);
@@ -2862,12 +3433,12 @@ function checkReviewGate(input) {
   const security = extractSecurityReviewVerdict(verifiedBodies);
   const codeReviewClean = codeReview.value === "APPROVE";
   const securityClean = security.value === "PASS";
-  const codeReviewBound = isBoundToHead(codeReview, input.headSha);
-  const securityBound = isBoundToHead(security, input.headSha);
-  if (codeReviewClean && codeReviewBound && securityClean && securityBound) {
+  const codeReviewBound = isBoundToPatch(codeReview, input.headSha, input.patchIdOf);
+  const securityBound = isBoundToPatch(security, input.headSha, input.patchIdOf);
+  if (codeReviewClean && codeReviewBound && securityClean && securityBound && mechanicalChecksClean) {
     return {
       verdict: "pass",
-      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}.`,
+      reason: `code-reviewer verdict is a clean APPROVE and security-review verdict is a clean PASS, both covering head ${input.headSha}, and every reported mechanical check is green.`,
       waived: false
     };
   }
@@ -2882,6 +3453,9 @@ function checkReviewGate(input) {
   } else if (!securityBound) {
     problems.push(`the newest security-review verdict covers ${security.headSha ?? "no recorded commit"}, head is ${input.headSha}`);
   }
+  if (!mechanicalChecksClean) {
+    problems.push(reportedMechanicalChecks.length === 0 ? "no mechanical checks have reported for this head yet" : `mechanical check(s) not green: ${reportedMechanicalChecks.filter((c) => c.bucket !== "pass").map((c) => `${c.name} (${c.bucket})`).join(", ")}`);
+  }
   const ignoredNote = ignoredCount > 0 ? ` ${ignoredCount} verdict-shaped comment(s) from authors outside the principal allowlist were ignored.` : "";
   return {
     verdict: "fail",
@@ -3161,72 +3735,6 @@ function compareToBaseline(current, baseline) {
     perTool
   };
 }
-// ../../packages/aeg-core/src/doctrine-portability.ts
-var DEFAULT_SHIPS_PREFIX = "aeg-root/";
-var STATIC_PORTABLE_PREFIXES = [
-  "roles/",
-  "contracts/",
-  "skills/",
-  ".github/",
-  ".vinaya/",
-  ".claude/",
-  ".git/",
-  ".husky/"
-];
-var EXEMPT_LITERALS = new Set([
-  "path/inside/the/shipped/diff.ts",
-  "path/inside/the/surface.ts",
-  "apps/x/specs/..."
-]);
-var CITED_PATH_PATTERN = /^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]*)+$/;
-var NON_PATH_TOP_SEGMENTS = new Set(["origin", "refs", "HEAD", "vinaya", "fix"]);
-function extractCitedPaths(content) {
-  const found = [];
-  const spanPattern = /`([^`\n]+)`/g;
-  let match = spanPattern.exec(content);
-  while (match !== null) {
-    const cited = match[1] ?? "";
-    const topSegment = cited.slice(0, cited.indexOf("/"));
-    if (CITED_PATH_PATTERN.test(cited) && !NON_PATH_TOP_SEGMENTS.has(topSegment)) {
-      found.push({ cited, index: match.index });
-    }
-    match = spanPattern.exec(content);
-  }
-  return found;
-}
-function lineAtIndex(content, index) {
-  let line = 1;
-  for (let i = 0;i < index; i++) {
-    if (content.charCodeAt(i) === 10)
-      line++;
-  }
-  return line;
-}
-function isPortable(cited, shipsPrefix) {
-  if (cited.startsWith(shipsPrefix))
-    return true;
-  return STATIC_PORTABLE_PREFIXES.some((prefix) => cited.startsWith(prefix));
-}
-function checkDoctrinePortability(files, shipsPrefix = DEFAULT_SHIPS_PREFIX) {
-  const findings = [];
-  for (const file of files) {
-    if (!file.path.startsWith(shipsPrefix))
-      continue;
-    for (const { cited, index } of extractCitedPaths(file.content)) {
-      if (EXEMPT_LITERALS.has(cited))
-        continue;
-      if (isPortable(cited, shipsPrefix))
-        continue;
-      findings.push({
-        file: file.path,
-        line: lineAtIndex(file.content, index),
-        cited,
-        message: `cites "${cited}", a path that only exists in the authoring repository — not portable doctrine`
-      });
-    }
-  }
-  return findings;
-}
 // ../../packages/aeg-core/src/reader-resolvable-prose.ts
 var SHIPS_PREFIX = "aeg-root/";
 function shipsArchivePrefix(shipsPrefix) {
@@ -3562,6 +4070,12 @@ function scanRetiredVocabulary(files) {
 function isHandClosedByRecognizedPrincipal(dep, principalAllowlist) {
   return dep.issueState === "closed" && dep.stateReason === "completed" && isPrincipal(dep.closedByActor ?? null, principalAllowlist);
 }
+function isSelfDependency(dep, task, issue) {
+  if (dep.issue !== null && issue !== null && dep.issue === issue.number)
+    return true;
+  const bare = dep.id.trim().replace(/^#/, "");
+  return bare.toLowerCase() === task.id.trim().toLowerCase();
+}
 function checkDispatchReadiness(input) {
   const { trancheSlug, task } = input;
   const taskLabel = `task ${task.id} (tranche ${trancheSlug})`;
@@ -3576,6 +4090,11 @@ function checkDispatchReadiness(input) {
     blockers.push(`dispatch-gate rationale: Issue #${input.issue.number} for ${taskLabel} fails the rationale gate (checkIssueRationale) — the Planner must complete the eight-field rationale before this task is dispatchable.`);
   }
   for (const dep of input.dependsOn) {
+    if (isSelfDependency(dep, task, input.issue)) {
+      const issueStr = input.issue !== null ? `#${input.issue.number}` : "?";
+      blockers.push(`dispatch-gate INTERNAL: parsed a self-dependency for task ${task.id} (${issueStr}) — this is a parser bug in parseRationaleDeps, not a real dependency. Please report it upstream. Re-run once the rationale is corrected or the fix ships.`);
+      continue;
+    }
     if (dep.resolved === false) {
       blockers.push(`dispatch-gate depends-on: ${taskLabel} depends on "${dep.id}", which is UNRESOLVABLE — the resolver could not find a matching tranche/task/Issue for this edge (not a claim about merge status). Not dispatchable until the edge is corrected.`);
       continue;
@@ -3815,27 +4334,27 @@ function evaluateTestPlanGate(body, branch) {
     };
   }
   const checkboxLines = section.split(`
-`).map((line) => line.trimStart()).filter((line) => /^[-*]\s+\[[ xX]\]/.test(line));
+`).map((line) => line.trimStart()).filter((line) => /^[-*]\s+\[[ xX]\]\s*\*{0,2}\[principal\]\*{0,2}/i.test(line));
   if (checkboxLines.length === 0) {
     return {
       verdict: "pass",
       messages: [
-        "Test Plan section found but has no checkbox items.",
+        "Test Plan section found but has no `[principal]` checkbox items.",
         "PASS (advisory) — the section may be empty or expressed in prose; verification is the Principal's call."
       ]
     };
   }
   const unchecked = checkboxLines.filter((line) => /^[-*]\s+\[\s\]/.test(line));
   const checked = checkboxLines.filter((line) => /^[-*]\s+\[[xX]\]/.test(line));
-  const messages = [`Test Plan items: ${checked.length} ticked, ${unchecked.length} unticked.`];
+  const messages = [`Test Plan [principal] items: ${checked.length} ticked, ${unchecked.length} unticked.`];
   if (unchecked.length > 0) {
-    messages.push("", "FAIL — the following Test Plan items are unticked:");
+    messages.push("", "FAIL — the following [principal] Test Plan items are unticked:");
     for (const line of unchecked)
       messages.push(`  ${line}`);
-    messages.push("", "Per aeg-root/roles/developer.md (Verification), a PR is not mergeable while any Test Plan box is unticked.", "- [agent] items: the Developer-agent posts the actual command output as evidence and ticks the box.", "- [principal] items: the Principal runs the item in a real signed-in browser and ticks the box.", "Note: editing the PR body does not retrigger most workflows. If your PR body changes do not surface here, push an empty commit to re-run.");
+    messages.push("", "Per aeg-root/roles/developer.md (Verification), a PR is not mergeable while any [principal] Test Plan box is unticked.", "The Principal runs the item in a real signed-in browser and ticks the box.", "Note: editing the PR body does not retrigger most workflows. If your PR body changes do not surface here, push an empty commit to re-run.");
     return { verdict: "fail", messages };
   }
-  messages.push("All Test Plan items ticked — runtime verification complete.", "PASS.");
+  messages.push("All [principal] Test Plan items ticked — runtime verification complete.", "PASS.");
   return { verdict: "pass", messages };
 }
 // ../../packages/aeg-core/src/workspace-escape.ts
@@ -3917,7 +4436,7 @@ function findWorkspaceEscapes(files, knownPaths, workspaceDirs = DEFAULT_WORKSPA
 }
 // src/lib/config.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2, realpathSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { z } from "zod";
@@ -4210,7 +4729,7 @@ function loadConfig() {
   if (!path)
     return null;
   try {
-    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    const raw = JSON.parse(readFileSync2(path, "utf-8"));
     return stripGlobalOnlyKeys(VinayaConfigSchema.parse(raw), path);
   } catch {
     return null;
@@ -4218,6 +4737,10 @@ function loadConfig() {
 }
 var TOKENS_COLLECT_TRUST_PATH = join(GLOBAL_VINAYA_HOME, "tokens-collect-trust.json");
 
+// src/lib/diff-evidence.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { join as join2, relative, resolve as resolve2 } from "node:path";
+
 // src/checks/contract.ts
 var CHECK_SCHEMA_VERSION = 1;
 function emitCheckError(error) {
@@ -4225,13 +4748,132 @@ function emitCheckError(error) {
 `);
 }
 
+// src/commands/review-post.ts
+function parseChangedLineRanges(diffOutput) {
+  const result = {};
+  let currentFile = null;
+  for (const line of diffOutput.split(`
+`)) {
+    if (line.startsWith("+++ ")) {
+      const path = line.slice(4).trim();
+      currentFile = path === "/dev/null" ? null : path.replace(/^b\//, "");
+      continue;
+    }
+    if (line.startsWith("@@") && currentFile) {
+      const m = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+      if (m) {
+        const start = Number(m[1]);
+        const count = m[2] !== undefined ? Number(m[2]) : 1;
+        if (count > 0) {
+          if (!result[currentFile])
+            result[currentFile] = [];
+          result[currentFile].push([start, start + count - 1]);
+        }
+      }
+    }
+  }
+  return result;
+}
+
+// src/lib/diff-evidence.ts
+function fileDiffAgainst(ref, path) {
+  let out;
+  try {
+    out = execFileSync3("git", ["diff", `${ref}...HEAD`, "--", path], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  return out === "" ? null : out;
+}
+function revParse(ref) {
+  try {
+    return execFileSync3("git", ["rev-parse", "--verify", ref], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function repoRoot() {
+  try {
+    return execFileSync3("git", ["rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function changedFiles(base) {
+  let out;
+  try {
+    out = execFileSync3("git", ["diff", "--name-only", `${base}...HEAD`], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  return out === "" ? [] : out.split(`
+`).map((s) => s.trim()).filter(Boolean);
+}
+function resolveChangedFiles(base = process.env.BASE_SHA || "origin/main") {
+  return resolveDiff(base)?.files ?? null;
+}
+function resolveDiff(base = process.env.BASE_SHA || "origin/main") {
+  const root = repoRoot();
+  if (root === null)
+    return null;
+  const head = revParse("HEAD");
+  for (const ref of [base, "main"]) {
+    const resolved = revParse(ref);
+    if (resolved === null || resolved === head)
+      continue;
+    const relPaths = changedFiles(ref);
+    if (relPaths === null)
+      continue;
+    return { base: ref, root, files: relPaths.map((p) => join2(root, p)) };
+  }
+  return null;
+}
+function changedLineRanges(ref, path) {
+  const diff = fileDiffAgainst(ref, path);
+  if (diff === null)
+    return null;
+  return parseChangedLineRanges(diff)[path] ?? null;
+}
+function lineIsInRanges(line, ranges) {
+  return ranges.some(([start, end]) => line >= start && line <= end);
+}
+function findingsInThisDiff(findings) {
+  const diff = resolveDiff();
+  if (diff === null)
+    return [...findings];
+  const changed = new Set(diff.files);
+  const ranges = new Map;
+  return findings.filter((f) => {
+    const abs = resolve2(diff.root, f.file);
+    if (!changed.has(abs))
+      return false;
+    const relPath = relative(diff.root, abs);
+    if (!ranges.has(relPath))
+      ranges.set(relPath, changedLineRanges(diff.base, relPath));
+    const fileRanges = ranges.get(relPath) ?? null;
+    return fileRanges === null ? true : lineIsInRanges(f.line, fileRanges);
+  });
+}
+
 // src/checks/bin/check-doctrine-portability.ts
 var CHECK_NAME = "doctrine-portability";
 var DOCTRINE_ROOT = loadConfig()?.proseGates?.doctrineRoot ?? "aeg-root";
 var SHIPS_PREFIX2 = `${DOCTRINE_ROOT}/`;
 function git(args) {
   try {
-    return execFileSync3("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    return execFileSync4("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
   } catch {
     return "";
   }
@@ -4244,7 +4886,7 @@ function collectWorkingTree(dir, out = []) {
     return out;
   }
   for (const name of entries) {
-    const full = join2(dir, name);
+    const full = join3(dir, name);
     let isDir;
     try {
       isDir = statSync(full).isDirectory();
@@ -4262,7 +4904,7 @@ function collectWorkingTree(dir, out = []) {
   return out;
 }
 function readWorkingTree(paths) {
-  return paths.map((p) => ({ path: p, content: readFileSync2(p, "utf8") }));
+  return paths.map((p) => ({ path: p, content: readFileSync3(p, "utf8") }));
 }
 function collectAtRef(ref, dir) {
   const listing = git(["ls-tree", "-r", "--name-only", ref, "--", dir]);
@@ -4271,7 +4913,7 @@ function collectAtRef(ref, dir) {
   return paths.map((p) => ({ path: p, content: git(["show", `${ref}:${p}`]) }));
 }
 function findingKey(f) {
-  return `${f.file}:${f.cited}`;
+  return `${f.file}:${f.kind}:${f.cited}`;
 }
 function newSince(baseline, current) {
   const remaining = new Map;
@@ -4297,10 +4939,12 @@ function main() {
   const currentFindings = checkDoctrinePortability(currentFiles, SHIPS_PREFIX2);
   const baselineFiles = collectAtRef(base, DOCTRINE_ROOT);
   const baselineFindings = checkDoctrinePortability(baselineFiles, SHIPS_PREFIX2);
-  const newFindings = newSince(baselineFindings, currentFindings);
+  const newFindings = findingsInThisDiff(newSince(baselineFindings, currentFindings));
   const baseline = captureBaseline([{ tool: CHECK_NAME, findingCount: baselineFindings.length }], new Date().toISOString());
   const comparison = compareToBaseline([{ tool: CHECK_NAME, findingCount: currentFindings.length }], baseline);
   console.log(`${CHECK_NAME}: doctrine root "${DOCTRINE_ROOT}"; ${currentFiles.length} file(s) at HEAD, ${baselineFiles.length} at "${base}"; ` + `baseline ${baselineFindings.length}, current ${currentFindings.length}, delta ${comparison.delta}; ${newFindings.length} new finding(s)`);
+  const PATH_RECOVERY_PROMPT = "This doctrine page cites a path that only resolves in the authoring repository, not in an adopter’s " + "install — an adopter cannot follow it. Rewrite the citation to a doctrine-relative path (`roles/...`, " + "`contracts/...`, `skills/...`, `aeg-root/...`) or an adopter-owned one (`.github/...`, `.vinaya/...`, " + "`.claude/...`), or state the fact without pointing at the file at all.";
+  const VENDOR_NAME_RECOVERY_PROMPT = "This doctrine page names an AI vendor/product/agent by name outside the one sanctioned fenced home " + "(`<!-- AEG:VENDOR-EXAMPLE:START -->` … `<!-- AEG:VENDOR-EXAMPLE:END -->` in `tranche-model.md` §12). " + `Rewrite the mention to refer to the host/agent generically (e.g. "the coding agent," "this repo's ` + 'shipped reference host," "an external, independently-hosted model") instead of by product name.';
   for (const finding of newFindings) {
     emitCheckError({
       schema: CHECK_SCHEMA_VERSION,
@@ -4309,7 +4953,7 @@ function main() {
       message: `${finding.file}:${finding.line}: ${finding.message}`,
       file: finding.file,
       line: finding.line,
-      agent_recovery_prompt: "This doctrine page cites a path that only resolves in the authoring repository, not in an adopter’s " + "install — an adopter cannot follow it. Rewrite the citation to a doctrine-relative path (`roles/...`, " + "`contracts/...`, `skills/...`, `aeg-root/...`) or an adopter-owned one (`.github/...`, `.vinaya/...`, " + "`.claude/...`), or state the fact without pointing at the file at all."
+      agent_recovery_prompt: finding.kind === "vendor-name" ? VENDOR_NAME_RECOVERY_PROMPT : PATH_RECOVERY_PROMPT
     });
   }
   process.exit(0);